fix(ci): build through the internal package cache; keep bundled npm on Node 18/20

- The first Node 24/26 run timed out on every job: public AlmaLinux mirrors
  served the runners at 1-150 kB/s. Use the CT130 package cache the same way
  cloud-apache-container does (same pkg-cache-repos.sh and pinned CA), with
  the upstream repos as fallback when the probe fails. epel-release is now
  GPG-verified before install instead of fetched unverified by URL.
- npm 12 requires Node >=22.22.2; on 18/20 keep the npm Node ships with.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -1,12 +1,23 @@
 FROM almalinux/10-base
 ARG NODEVER=20
 
+# OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=https://192.168.1.40
+# (CT130 pkg-cache, https only). Unset = upstream repositories. epel-release is
+# GPG-verified against keys/pkg-cache/ either way. Repo files are restored at
+# the end of the RUN, so no layer keeps the cache address. Same script as
+# cloud-apache-container (scripts/pkg-cache-repos.sh, docs/pkg-cache.md there).
+ARG PKG_CACHE=
+COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
+COPY ./keys/pkg-cache/ /usr/local/share/pkg-cache/
 # Install repos, update, install only needed packages, clean up in one layer
-RUN dnf install -y \
-      https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm && \
+RUN /usr/local/sbin/pkg-cache-repos.sh rpm && \
+    /usr/local/sbin/pkg-cache-repos.sh release-install epel && \
+    /usr/local/sbin/pkg-cache-repos.sh rpm && \
+    printf 'retries=10\ntimeout=60\n' >> /etc/dnf/dnf.conf && \
     dnf update -y && \
     dnf install -y wget procps cronie iproute nginx openssl git microdnf make gcc gcc-c++ dumb-init && \
     dnf group install -y 'Development Tools' && \
+    /usr/local/sbin/pkg-cache-repos.sh restore && \
     dnf clean all && \
     rm -rf /var/cache/dnf /usr/share/doc /usr/share/man /usr/share/locale/* \
            /var/cache/yum /tmp/* /var/tmp/*